Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    11/12/2024, 15:19

General

  • Target

    e211a2f1b4ca7346bee7dc2f14a7e7d5_JaffaCakes118.exe

  • Size

    152KB

  • MD5

    e211a2f1b4ca7346bee7dc2f14a7e7d5

  • SHA1

    b98db443285640f67e8cc5a0a434142c762d9e37

  • SHA256

    dcb35d1d4de318d4f72efb1d709174a14b552d7006347ee6b89ae889ab131daa

  • SHA512

    34cb119d79b4e37b36949bf0b17bc1bcc1bbf07435555fdde7e17fd6a0c87d0a0a429534413856ab004bd7737228977089e087211993b1f667aba454e5b2db1b

  • SSDEEP

    1536:c1DMz1DQvXLq6t7awFONecenlLnQHIG5R9c73P600t:9eGw9A0rC00t

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 4 IoCs
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 16 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e211a2f1b4ca7346bee7dc2f14a7e7d5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e211a2f1b4ca7346bee7dc2f14a7e7d5_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2280
    • C:\Users\Admin\AppData\Local\Temp\e211a2f1b4ca7346bee7dc2f14a7e7d5_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\e211a2f1b4ca7346bee7dc2f14a7e7d5_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\VMABW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2996
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhust" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe" /f
          4⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:2524
      • C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
        "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1672
        • C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
          "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2220
        • C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
          "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2524
          • C:\Users\Admin\AppData\Roaming\AdobeART.exe
            "C:\Users\Admin\AppData\Roaming\AdobeART.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2964
            • C:\Users\Admin\AppData\Roaming\AdobeART.exe
              "C:\Users\Admin\AppData\Roaming\AdobeART.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2948
              • C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
                "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2284
                • C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
                  "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  PID:904
                • C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
                  "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:2564
                  • C:\Users\Admin\AppData\Roaming\AdobeART.exe
                    "C:\Users\Admin\AppData\Roaming\AdobeART.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:2524
                    • C:\Users\Admin\AppData\Roaming\AdobeART.exe
                      "C:\Users\Admin\AppData\Roaming\AdobeART.exe"
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:888
                      • C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
                        "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:2820
                        • C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
                          "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of SetWindowsHookEx
                          PID:884
                        • C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
                          "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
                          12⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • System Location Discovery: System Language Discovery
                          PID:2836

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\VMABW.bat

    Filesize

    141B

    MD5

    e83a2e0b3c1e03dfb96ffd9924117a45

    SHA1

    27a3e4ba115ba1bad0bf094f5b97e768d1ece33e

    SHA256

    655407d94fff9e707712a588d97a2017cc1c9d690a67c688ed0abcb79e452b13

    SHA512

    5f61686a3b7db3544d83a4f2ce1a75868c7dc266709f72a34eafecc3a26696a985b1912a559aed8f5a2cacbfe26be9beae2374340d1801bb18473de785557480

  • \Users\Admin\AppData\Roaming\svhust\svhust.exe

    Filesize

    152KB

    MD5

    d8b58c28d67a1a6e653c38705b945959

    SHA1

    21f4802a83bb6bf22e27b1646c9416a8bbe5875a

    SHA256

    63e4250bba87874f1ef49ef80bc3542ff4fcc267245de03ddfa695632021c329

    SHA512

    981d10cb9cd95b72cc6f9c7a2801371504addc7d1c59a8d07dbad4a0356182107dd8161578fcef0d028d915811dd1f948d54dd2e634ce9108f555d348ca7531f

  • memory/884-2206-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/888-2201-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/904-2203-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2028-365-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2028-780-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2220-2202-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2220-745-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2280-10-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2280-347-0x0000000000310000-0x0000000000311000-memory.dmp

    Filesize

    4KB

  • memory/2280-4-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2280-349-0x00000000005E0000-0x00000000005E1000-memory.dmp

    Filesize

    4KB

  • memory/2280-20-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2280-16-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/2280-348-0x0000000000360000-0x0000000000361000-memory.dmp

    Filesize

    4KB

  • memory/2280-2-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2280-346-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/2524-793-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2524-777-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2564-1503-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2564-1489-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2836-2196-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2836-2207-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2948-1487-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2948-1110-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB